Top Risks

• Brand impersonation: uses 'YouTube™' trademark without confirmed ownership; dev is gmail-only with no verified org.
• Verified publisher with gmail dev email and no developer name raises accountability concerns.
• Privacy policy admits third-party sharing without data retention disclosure; inadequate for enterprise.
• function_constructor pattern in 3 JS files + dynamic script injection with no CSP; code execution surface.
• host_permissions <all_urls> far exceeds content_scripts scope (*://*.youtube.com/*); scope mismatch.

Evidence

• brand_impersonation store Title uses 'YouTube™' trademark; brand_mention.is_impersonation=true, developer not confirmed owner.
• gmail_dev_no_name store developer_email=daniel17cook@gmail.com, developer_name empty; free webmail + no business identity.
• host_scope_mismatch manifest host_permissions=<all_urls> but content_scripts limited to *://*.youtube.com/*; over-broad host grant.
• function_constructor_multi crx new Function() constructor in options.js, skip-ad.js, background.js — dynamic code execution risk.
• dynamic_script_injection crx script_src_dynamic in skip-ad.js; dynamic <script src> creation detected.
• privacy_third_party_sharing api Policy fetched: scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• no_csp manifest content_security_policy=null; MV3 default applies but no explicit CSP hardening present.
• verified_publisher_gmail store verified_publisher=true but email is gmail; verification discount capped due to impersonation signal.

Permissions Breakdown

• storage low Stores extension settings locally; minimal risk.
• scripting medium Allows programmatic script injection into pages; elevated risk with broad host access.
• tabs medium Can read tab URLs and metadata; moderate privacy risk.
• declarativeNetRequest medium Blocks/redirects network requests; appropriate for adblock but powerful.
• <all_urls> high Host access to all URLs far exceeds YouTube-only content_scripts scope; broad surface.

Pillar Scores

Bookkeeping